- Payment Methods & Security
Payment Methods & Security
Our online payments are securely handled Paypal.
Paypal is an established UK company which has an excellent reputation for security and reliability. Payment is totally secure.
The secure ‘padlock’ icon is visible on the payment gateway page after your order placement and before you submit payment to be taken.
Transaction Encryption via SSL: Purchase details are encapsulated using and digitally-signed protocol. This ensures that the information passed is secure and tamper-proof via SSL.
Maintaining your privacy and your trust is very important. We aim to be especially clear on how we use your personal information if and when we collect it, and on the ways in which we can work together to protect your privacy.
UK Data Protection & Privacy legislation and the Applied GDPR (General Data Protection Regulation also known as Regulation (EU)2016/679.
What products and services are covered by this policy?
For the purpose of the data protection & Privacy legislation the Data Controller is Puffin Swim .
Legal Status “I” “we” “us” “our”
Trading as Puffin Swim
Postal Address: 2 Compston Road, Ambleside. LA22 9DJ. UK
Email address: [email protected]
Purpose and legitimate interest.
How do we use the information we collect?
We may use the information we collect for a variety of purposes, including to:
Make our Services work for you;
Provide, operate, maintain, improve, personalise, and promote our services;
Develop new products, services, features, and functionality;
Process and complete transactions, and send you related information, including purchase confirmations and invoices;
Communicate with you, including responding to your comments, questions, and requests; providing customer service and support;
Providing you with information about services, transmitting technical notices, updates, security alerts, administrative messages, or advertising or marketing messages;
Providing other news or information about us;
Monitor and analyse trends, usage, and activities in connection with our services;
Investigate and prevent fraudulent transactions, unauthorised access to our Services and other illegal activities.
Lawful Basis of Processing
How do we get your consent for collecting and storing information?
We only process personal data on the basis that:-
Such processing is necessary in order to enter into or preform a contact for our service(s).
Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
It is necessary for compliance with a legal obligation to which the controller is subject.
We have a legitimate interest which is not overridden by the rights or freedoms of the affected data subjects.
The data subject has consented to such processing.
Special Category Lawful Basis of Processing
We only process special category personal data in relation to employment on the basis that:-
It is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject.
Processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.
Categories of personal data and sources
What information do we collect from you, and how is it used?
You can visit our website without telling us who you are and without revealing any personal information about yourself. To provide full service however, we will most often need to collect information about you when you register for an account and when you create or modify your personal data on one of our Services. The types of Information we collect may include email address, country of residence, your name, postal address and phone number.
We do not process sensitive / special categories of personal data, nor facilitate processing personal data of data subjects under the age of consent (children).
Logs:We may record certain information and store it in log files when you interact with our Services. This information may include Internet Protocol (IP) or other device addresses or ID numbers as well as browser type, Internet service provider, URLs or referring / exit pages, operating system, date/time stamp, information you search for, local and language preferences, your mobile carrier, and system configuration information.
Analytics:We and our analytics providers also collect and store analytics information when you use our Services to help us improve our Services. We make sure this data is anonymous by not connecting analytics data to personally identifiable data number as a name, email address, physical address, or phone number.
How might we share information?
We are not in the business of selling your personal information. We consider this information to be a vital part of our relationship to you. There are, however, certain circumstances in which we may share your personal information with third party processors, as set forth below.
With your consent: We will not share your personal information with companies, organisations, or individuals who are not associated with us unless we have your affirmative consent to do so.
Payment Processing: We use a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing.
Newsletter Service: We use a commercial application to facilitate our newsletter service.
Compliance with Laws and Law Enforcement Requests; Protection of Our Rights: We may disclose your information (including your personal information) to a third party if:
We believe that disclosure is reasonably necessary to comply with any applicable law, regulation, legal process or government request
To protect the security or integrity of our products and services
To protect our property, rights, and safety and that of our customers of the public from harm or illegal activities
To respond to an emergency which we believe in the good faith required is to injury of any person; or
To investigate and defend ourselves against any third-party claims or allegations.
We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. We will notify you of such a change in ownership or transfer of assets by posting a notice on our website.
The data controller does not transfer personal data outside of the United Kingdom or European Union, apart from the following exceptions where indicated below. All data processors acting on behalf of the data controller have appropriate safeguards in place. For example, those operating in the USA, are signed up to the EU-US Privacy Shield.
Data Processing Information
The following third-party services providers are used by us and only process data in accordance with the instructions from the data controller:-
- MailChimp https://mailchimp.com/legal/privacy/ Newsletter sign-up
- PayPal https://www.paypal.com/en/webapps/mpp/ua/privacy-full Payment Processing
How long will we keep the personal data?
Retaining some data may be subject to a statutory retention period and this must be adhered to, (to keep certain data for a minimum period of time). This may include personal data (name, address, contact details), but on expiry of such statutory requirement, such data will be destroyed securely. Where possible any personally identifiable data will be anonymised or pseudonymed
Your information we use for marketing purposes will be kept with us until you notify us that you no longer wish to receive this information. Our backup routine keeps data for a rolling 30 day period after which time the data is removed from all systems.
Statutory or other requirements
The data controller does not process personal data in respect of any statutory requirement, nor require personal data to be supplied as part of any contractual agreement, however in respect of the controller’s services, certain communications may not be possible without such personal data being supplied, for example an email to furnish with updates information etc. or an address to fulfil an order.
Profiling and Automated Decision Making
No profiling or automatic decision making processes are undertaken by the data controller in respect of any personal data processing activities.
Your fundamental rights as a Data Subject are:
The right to be informed
The right of access
The right of rectification
The right of erasure (often known as the right to be forgotten)
The right to prevent processing
The right to data portability
The right to object
Rights in relation to automatic decision making and profiling.
Under the right of access (2), you have the right to obtain:-
Confirmation that your data is being processed;
Access to your personal data; and
Other supplementary information
So that you are aware of and can verify the lawfulness of the processing.
Your right to access can be exercised by contacting the data controller as above. Please note that not all of the fundamental rights are absolute some apply in certain circumstances only.
Your right to complain to the supervisory authority/regulator
You have the right to complain about the organisations processing your personal data. You can exercise this right by contacting the supervisory authority of the data controller as follows:-
Information Commissioner’s Office
Tel: 03031 231113 (local rate)